CVE-2025-71420 json
UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply
published 2026-09-21 49 d ago modified 2026-10-14 26 d ago also EUVD-2025-210976
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
Patch / fix
- uvdesk core-framework 1.1.7
- uvdesk community-skeleton 1.1.8
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 49 d ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hackmd.io https://hackmd.io/@leediay/B1Cz5voFGg referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- uvdesk core-framework
- uvdesk community-skeleton
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/uvdesk/core-framework/commit/de0422869708eb17a54bf6a98166abb80c0d483d
patch
-
hackmd.io
/@leediay/B1Cz5voFGg
third-party-advisory, exploit
-
github.com
/uvdesk/core-framework/blob/v1.1.6/Services/TicketService.php#L1752-L1759
technical-description
-
github.com
/uvdesk/core-framework/blob/v1.1.6/Controller/TicketXHR.php#L838-L850
technical-description
-
github.com
/uvdesk/core-framework/releases/tag/v1.1.7
release-notes
-
github.com
/uvdesk/community-skeleton/releases/tag/v1.1.8
release-notes
-
github.com
/uvdesk/core-framework
product
-
vulncheck.com
/advisories/uvdesk-core-framework-before-1.1.7-authorization-bypass-via-saved-reply
third-party-advisory
Sources
- CVE List CVE-2025-71420
- NVD CVE-2025-71420
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.